Setting it at L167 doesn't make it available to the next middleware because `req.oauth2 !== txn` when the response is deserialized certain keys of `txn` are copied to `req.oauth2` and when it's serialized certain keys of `req.oauth2` is copied to `txn`.

I don't think there's any harm in moving the line down into the `allow !== true` condition, but it has to exist.